I'm currently trying to wrap my head around how to prevent CSRF.
My first solution was to use a token which is suggested everywhere. That would of course fix this problem:
But what I can't get my head around is that.
Will indeed fail because a valid token didn't come along with that request, but what prevents an attacker from doing the above and instead just do the following
GET http://api.example.com/me/token/generate // parse the response GET http://api.example.com/me/delete?token=...
Valid token was passed along the request, my user is now deleted...
My REST API allows any request to come through.
header("Access-Control-Allow-Origin: " . $_SERVER["HTTP_ORIGIN"]);
If tokens in this case aren't a "safe" solution, then what would/could a safer/better solution be?
Further what does something like Spotify do, while they both have their "Web API" and the music software itself?
Also and I know this is far fetched, but is it possible to allow anything access to my API but have a per origin authentication?
I know this is far fetched, as the "solution" would be to check the origin header, but that can be spoofed.